DOCSLIB.ORG

Technical Impacts of DNS Privacy and Security on Network Service Scenarios

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

- Technical Impacts of DNS Privacy and Security on Network Service Scenarios ATIS-I-0000079 | April 2020 Abstract The domain name system (DNS) is a key network function used to resolve domain names (e.g., atis.org) into routable addresses and other data. Most DNS signalling today is sent using protocols that do not support security provisions (e.g., cryptographic confidentiality protection and integrity protection). This may create privacy and security risks for users due to on-path nodes being able to read or modify DNS signalling. In response to these concerns, particularly for DNS privacy, new protocols have been specified that implement cryptographic DNS security. Support for these protocols is being rapidly introduced in client software (particularly web browsers) and in some DNS servers. The implementation of DNS security protocols can have a range of positive benefits, but it can also conflict with important network services that are currently widely implemented based on DNS. These services include techniques to mitigate malware and to fulfill legal obligations placed on network operators. This report describes the technical impacts of DNS security protocols in a range of network scenarios. This analysis is used to derive recommendations for deploying DNS security protocols and for further industry collaboration. The aim of these recommendations is to maximize the benefits of DNS security support while reducing problem areas. Foreword As a leading technology and solutions development organization, the Alliance for Telecommunications Industry Solutions (ATIS) brings together the top global ICT companies to advance the industry’s business priorities. ATIS’ 150 member companies are currently working to address network reliability, 5G, robocall mitigation, smart cities, artificial intelligence-enabled networks, distributed ledger/blockchain technology, cybersecurity, IoT, emergency services, quality of service, billing support, operations and much more. These priorities follow a fast-track development lifecycle from design and innovation through standards, specifications, requirements, business use cases, software toolkits, open source solutions and interoperability testing. ATIS is accredited by the American National Standards Institute (ANSI). ATIS is the North American Organizational Partner for the 3rd Generation Partnership Project (3GPP), a founding Partner of the oneM2M global initiative, a member of the International Telecommunication Union (ITU), as well as a member of the Inter-American Telecommunication Commission (CITEL). For more information, visit www.atis.org. Follow ATIS on Twitter and on LinkedIn. i Notice of Disclaimer and Limitation of Liability The information provided in this document is directed solely to professionals who have the appropriate degree of experience to understand and interpret its contents in accordance with generally accepted engineering or other professional standards and applicable regulations. No recommendation as to products or vendors is made or should be implied. NO REPRESENTATION OR WARRANTY IS MADE THAT THE INFORMATION IS TECHNICALLY ACCURATE OR SUFFICIENT OR CONFORMS TO ANY STATUTE, GOVERNMENTAL RULE OR REGULATION, AND FURTHER, NO REPRESENTATION OR WARRANTY IS MADE OFMERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR AGAINST INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS. ATIS SHALL NOT BE LIABLE, BEYOND THE AMOUNT OF ANY SUM RECEIVED IN PAYMENT BY ATIS FOR THIS DOCUMENT, AND IN NO EVENT SHALL ATIS BE LIABLE FOR LOST PROFITS OR OTHER INCIDENTAL OR CONSEQUENTIAL DAMAGES. ATIS EXPRESSLY ADVISES THAT ANY AND ALL USE OF OR RELIANCE UPON THE INFORMATION PROVIDED IN THIS DOCUMENT IS AT THE RISK OF THE USER. NOTE: The user’s attention is called to the possibility that compliance with this standard may require use of an invention covered by patent rights. By publication of this standard, no position is taken with respect to whether use of an invention covered by patent rights will be required, and if any such use is required no position is taken regarding the validity of this claim or any patent rights in connection therewith. Please refer to [http://www.atis.org/legal/patentinfo.asp] to determine if any statement has been filed by a patent holder indicating a willingness to grant a license either without compensation or on reasonable and non-discriminatory terms and conditions to applicants desiring to obtain a license. ii Copyright Information ATIS-I-0000079 Copyright © 2020 by Alliance for Telecommunications Industry Solutions All rights reserved. Alliance for Telecommunications Industry Solutions 1200 G Street, NW, Suite 500 Washington, DC 20005 No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written permission of the publisher. For information, contact ATIS at (202) 628-6380. ATIS is online at http://www.atis.org. iii Table of Contents 1 Introduction ................................................................................................................................................ 1 2 Executive Summary.................................................................................................................................. 1 3 Implications and Recommendations ................................................................................................ 3 4 Current ISP DNS Services and Features ........................................................................................... 5 5 DNS Protocols ........................................................................................................................................... 9 6 Scenarios ................................................................................................................................................... 15 7 Conclusion ................................................................................................................................................ 31 8 Acronyms and Abbreviations ............................................................................................................. 32 Appendix 1 – Organizational and Customer Communications and Talking Points .............. 33 iv 1 Introduction The domain name system (DNS) provides an essential function for distributed applications of resolving human-readable names into network routable IP addresses. As such, DNS provides a bridge between the application domain and the network domain. The ubiquitous nature of DNS means it has also become a platform for distributing application-specific information such as domain-based message authentication, reporting and conformance (DMARC) email security policy. Given the key role that DNS plays in network routing and operation, the network domain has employed DNS in support of local services, network optimization, fulfillment of legal requirements and to enhance the online security of network users. The dual role of DNS—as an internet-wide database and a network service function—potentially creates tension between application and network interests, with contrasting perspectives in different technical communities. Encrypted DNS protocols such as DNS over HTTPS (DoH) and DNS over Transport Layer Security (TLS) (DoT) are now being rolled out, which brings the different perspectives about the role of DNS into sharp focus. Encrypted DNS protocols can increase user privacy and security, but deployments should consider the public and private network impacts because they may have deleterious impacts on the overall network operation and robustness. This report will identify some of the most important public and private network scenarios that involve DNS network features and analyze the technical impacts of DNS privacy protocols. The focus will be on the client-to-server (including stub-to-recursive-resolver) interface. Based on this analysis, recommendations for how to deploy and operate DoH and DoT will be generated. 2 Executive Summary Client operating systems and applications are rapidly introducing support for the encrypted DNS protocols DoT and DoH. These protocols provide integrity protection and confidentiality for DNS requests and responses between the client and the responding DNS server. This can improve user privacy and security in all deployment scenarios. Encrypted DNS protocols are a useful addition to the network security toolkit. Given the important and diverse role of DNS in network operations and policy enforcement, any changes to DNS behavior in clients should be studied for impacts on the complete networked system. Measures should be taken, if necessary, to maintain the best possible service. In the case of support for DoT and DoH, there are impacts on systems in three main areas: • The absence of industry norms for how to deploy and operationalize encrypted DNS in servers and clients is leading to the adoption of piecemeal solutions that differ in each implementation. This is creating a confusing situation, which risks a range of service problems or security loopholes due to incompatible assumptions in different implementations. In some cases, this may lead to users finding services or devices that fail to operate. They may also find that there is no single point of contact capable of understanding and resolving service problems due to the complex interactions between the different components. • Some clients are disregarding DNS server provisioning information received from the network, e.g., in Dynamic Host Configuration Protocol (DHCP), and instead selecting their
Recommended publications
  • Adopting Encrypted DNS in Enterprise Environments

    Adopting Encrypted DNS in Enterprise Environments

    National Security Agency | Cybersecurity Information Adopting Encrypted DNS in Enterprise Environments Executive summary Use of the Internet relies on translating domain names (like “nsa.gov”) to Internet Protocol addresses. This is the job of the Domain Name System (DNS). In the past, DNS lookups were generally unencrypted, since they have to be handled by the network to direct traffic to the right locations. DNS over Hypertext Transfer Protocol over Transport Layer Security (HTTPS), often referred to as DNS over HTTPS (DoH), encrypts DNS requests by using HTTPS to provide privacy, integrity, and “last mile” source authentication with a client’s DNS resolver. It is useful to prevent eavesdropping and manipulation of DNS traffic. While DoH can help protect the privacy of DNS requests and the integrity of responses, enterprises that use DoH will lose some of the control needed to govern DNS usage within their networks unless they allow only their chosen DoH resolver to be used. Enterprise DNS controls can prevent numerous threat techniques used by cyber threat actors for initial access, command and control, and exfiltration. Using DoH with external resolvers can be good for home or mobile users and networks that do not use DNS security controls. For enterprise networks, however, NSA recommends using only designated enterprise DNS resolvers in order to properly leverage essential enterprise cybersecurity defenses, facilitate access to local network resources, and protect internal network information. The enterprise DNS resolver may be either an enterprise-operated DNS server or an externally hosted service. Either way, the enterprise resolver should support encrypted DNS requests, such as DoH, for local privacy and integrity protections, but all other encrypted DNS resolvers should be disabled and blocked.
  • GNU Guix Cookbook Tutorials and Examples for Using the GNU Guix Functional Package Manager

    GNU Guix Cookbook Tutorials and Examples for Using the GNU Guix Functional Package Manager

    GNU Guix Cookbook Tutorials and examples for using the GNU Guix Functional Package Manager The GNU Guix Developers Copyright c 2019 Ricardo Wurmus Copyright c 2019 Efraim Flashner Copyright c 2019 Pierre Neidhardt Copyright c 2020 Oleg Pykhalov Copyright c 2020 Matthew Brooks Copyright c 2020 Marcin Karpezo Copyright c 2020 Brice Waegeneire Copyright c 2020 Andr´eBatista Copyright c 2020 Christine Lemmer-Webber Copyright c 2021 Joshua Branson Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled \GNU Free Documentation License". i Table of Contents GNU Guix Cookbook ::::::::::::::::::::::::::::::: 1 1 Scheme tutorials ::::::::::::::::::::::::::::::::: 2 1.1 A Scheme Crash Course :::::::::::::::::::::::::::::::::::::::: 2 2 Packaging :::::::::::::::::::::::::::::::::::::::: 5 2.1 Packaging Tutorial:::::::::::::::::::::::::::::::::::::::::::::: 5 2.1.1 A \Hello World" package :::::::::::::::::::::::::::::::::: 5 2.1.2 Setup:::::::::::::::::::::::::::::::::::::::::::::::::::::: 8 2.1.2.1 Local file ::::::::::::::::::::::::::::::::::::::::::::: 8 2.1.2.2 `GUIX_PACKAGE_PATH' ::::::::::::::::::::::::::::::::: 9 2.1.2.3 Guix channels ::::::::::::::::::::::::::::::::::::::: 10 2.1.2.4 Direct checkout hacking:::::::::::::::::::::::::::::: 10 2.1.3 Extended example ::::::::::::::::::::::::::::::::::::::::
  • Guide De Protection Numérique Des Sources Journalistiques

    Guide De Protection Numérique Des Sources Journalistiques

    Guide de Protection numérique des Sources journalistiques Mise en œuvre simplifiée Par Hector Sudan Version du document : 23.04.2021 Mises à jour disponibles gratuitement sur https://sourcesguard.ch/publications Guide de Protection numérique des Sources journalistiques Les journalistes ne sont pas suffisamment sensibilisés aux risques numé- riques et ne disposent pas assez d'outils pour s'en protéger. C'est la consta- tation finale d'une première recherche sociologique dans le domaine jour- nalistique en Suisse romande. Ce GPS (Guide de Protection numérique des Sources) est le premier résultat des recommandations de cette étude. Un GPS qui ne parle pas, mais qui va droit au but en proposant des solutions concrètes pour la sécurité numérique des journalistes et de leurs sources. Il vous est proposé une approche andragogique et tactique, de manière résumée, afin que vous puissiez mettre en œuvre rapidement des mesures visant à améliorer votre sécurité numérique, tout en vous permettant d'être efficient. Même sans être journaliste d'investigation, vos informations et votre protection sont importantes. Vous n'êtes peut-être pas directement la cible, mais pouvez être le vecteur d'une attaque visant une personne dont vous avez les informations de contact. Hector Sudan est informaticien au bénéfice d'un Brevet fédéral en technique des sys- tèmes et d'un MAS en lutte contre la crimina- lité économique. Avec son travail de master l'Artiste responsable et ce GPS, il se posi- tionne comme chercheur, formateur et consul- tant actif dans le domaine de la sécurité numé- rique pour les médias et journalistes. +41 76 556 43 19 keybase.io/hectorsudan [email protected] SourcesGuard Avant propos Ce GPS (Guide de Protection numérique des Sources journalistes) est à l’image de son acronyme : concis, clair, allant droit au but, tout en offrant la possibilité de passer par des chemins techniquement complexes.
  • Captive Portal Detection Error May Be Triggered If There Is HTTP 302 Response Code Received PRS-325375 While Connecting to IVE

    Captive Portal Detection Error May Be Triggered If There Is HTTP 302 Response Code Received PRS-325375 While Connecting to IVE

    Pulse Connect Secure Release Notes 8.1 R4 Build 37085: July 2015 Revision 01 Contents Introduction......................................................................................................................... 1 Interoperability and Supported Platforms ............................................................................ 2 Noteworthy changes in 8.1r4 Release ................................................................................ 2 Problems Resolved in 8.1R4 Release ................................................................................ 2 Known Issues in 8.1R3.2 release ....................................................................................... 4 Problems Resolved in 8.1R3.1 Release ............................................................................. 4 Pulse Connect Secure New Features in 8.1R3 ................................................................... 5 Noteworthy changes in this Release................................................................................... 6 Problems Resolved in 8.1R3 Release ................................................................................ 6 Known Issues in this release .............................................................................................. 7 Pulse Connect Secure Access New Features in 8.1R2 Release ........................................ 8 Disable TLS 1.0 ....................................................................................................... 8 New Functionality to create role mapping rules
  • Filtering and Identifying Web Activity by User Name

    Filtering and Identifying Web Activity by User Name

    Wavecrest®TechBrief Filtering and Identifying Web Activity by User Name www.wavecrest.net When a company implements a Web filtering and monitoring solution, it typically wants to filter and monitor the Web traffic flowing through its network by user name versus IP address for various reasons. Some of these reasons include curtailing casual surfing, protecting against security threats, and conserving bandwidth. Furthermore, a company’s Acceptable Use Policy (AUP) is usually based on user names and/or groups of user names. Therefore, the application that enforces and monitors the company’s AUP needs to identify Web activity by user name. IP addresses can be dynamic, and sometimes more than one employee can log on to a computer, and hence, more than one user name will be using the same IP address. Many an IT administrator is tasked with ensuring that the company’s employees are going through the proxy that is in place, so that Web activity can be monitored by user name. To get user names and authenticate users, IT administrators can choose any of the proxy configuration options and authentication methods described below. Depending on the company’s preference, one proxy configuration option may be more favorable than the other. Here, we will discuss applying browser settings manually, pushing out group policies using Active Directory (AD), using a captive portal, and installing client software. We will also touch on the different ways that you can authenticate your Internet users using our CyBlock products. Applying Browser Settings Manually Applying browser settings involves identifying a proxy server which is required if you need user names.
  • Ikev2 Configuration for Encrypted DNS

    Ikev2 Configuration for Encrypted DNS

    IKEv2 Configuration for Encrypted DNS draft-btw-add-ipsecme-ike Mohamed Boucadair (Orange) Tirumaleswar Reddy (McAfee, Inc.) Dan Wing (Citrix Systems, Inc.) Valery Smyslov (ELVIS-PLUS) July 2020, IETF#108 Agenda • Context • A Sample Use Case • IKE Configuration Attribute for Encrypted DNS • Next Steps 2 Problem Description • Several schemes to encrypt DNS have been specified – DNS over TLS (RFC 7858) – DNS over DTLS (RFC 8094) – DNS over HTTPS (RFC 8484) • …And others are being specified: – DNS over QUIC (draft-ietf-dprive-dnsoquic) • How to securely provision clients to use Encrypted DNS? This use can be within or outside the IPsec tunnel 3 A Sample Use Case: DNS Offload • VPN service providers can offer publicly accessible Encrypted DNS – the split-tunnel VPN configuration allows the client to access the DoH/DoT servers hosted by the VPN provider without traversing the tunnel 4 A Sample Use Case: Protecting Internal DNS Traffic • DoH/DoT ensures DNS traffic is not susceptible to internal attacks – see draft-arkko-farrell-arch-model-t-03#section-3.2.1 • encrypted DNS can benefit to Roaming Enterprise users to enhance privacy – With DoH/DoT the visibility of DNS traffic is limited to only the parties authorized to act on the traffic (“Zero Trust Architecture”) 5 Using IKE to Configure Encrypted DNS on Clients • New configuration attribute INTERNAL_ENC_DNS is defined to convey encrypted DNS information to clients: – Encrypted DNS type (e.g., DoH/DoT) – Scope of encrypted DNS use – One or more encrypted DNS server IPv6 addresses • For IPv4
  • 9 Caching Proxy Server

    9 Caching Proxy Server

    webXaccelerator: Owner's Guide by Luis Soltero, Ph.D., MCS Revision 1.06 February 10, 2010 (v1.2.3.10-RELEASE) Copyright © 2010 Global Marine Networks, LLC Table of Contents 1 Quick Start..............................................................................................................................................5 2 Introduction.............................................................................................................................................8 3 Initial Installation and Configuration......................................................................................................9 3.1 Connections.....................................................................................................................................9 3.2 Power-up..........................................................................................................................................9 3.3 Power-down...................................................................................................................................10 3.4 Web Administrator........................................................................................................................10 3.5 LAN Setup.....................................................................................................................................10 3.6 WAN Setup....................................................................................................................................11 3.7 WAN2 (Backup WAN) Setup........................................................................................................13
  • Paper, We Note That Work Is with Help from Volunteer OONI Probe Users

    Paper, We Note That Work Is with Help from Volunteer OONI Probe Users

    Measuring DoT/DoH Blocking Using OONI Probe: a Preliminary Study Simone Basso Open Observatory of Network Interference [email protected] Abstract—We designed DNSCheck, an active network exper- delivery networks (CDN). This fact raises concerns regarding iment to detect the blocking of DoT/DoH services. We imple- performance [25], competition, and privacy [14]. mented DNSCheck into OONI Probe, the network-interference (While DoH’s centralization and the resulting privacy con- measurement tool we develop since 2012. We compiled a list of popular DoT/DoH services and ran DNSCheck measurements cerns are not the focus of this paper, we note that work is with help from volunteer OONI Probe users. We present pre- underway to mitigate them [38] [24].) liminary results from measurements in Kazakhstan (AS48716), Simultaneously, the rollout of DoT and DoH does not Iran (AS197207), and China (AS45090). We tested 123 DoT/DoH fully solve the surveillance and censorship issues posed by services, corresponding to 461 TCP/QUIC endpoints. We found a cleartext internet. There are at least two remaining fields endpoints to fail or succeed consistently. In AS197207 (Iran), 50% of the DoT endpoints seem blocked. Otherwise, we found that could reveal the precise target of otherwise encrypted that more than 80% of the tested endpoints were always reach- communications. They are the Server Name Indication [19] able. The most frequently blocked services are Cloudflare’s and (SNI) extension inside the TLS ClientHello and the destination Google’s. In most cases, attempting to reach blocked endpoints IP address. However, in a landscape increasingly dominated by failed with a timeout.
  • Tunneled Internet Gateway Wi-Fi Access for Mobile Devices in High-Security Environments Table of Contents

    Tunneled Internet Gateway Wi-Fi Access for Mobile Devices in High-Security Environments Table of Contents

    WHITE PAPER TUNNELED INTERNET GATEWAY Wi-FI ACCESS FOR MOBILE DEVICES IN High-SECURitY ENVIRONMENTS TABLE OF CONTENTS THE ChALLENGE: Wi-FI ACCESS FOR MOBILE DEVICES IN high-SECURitY ENVIRONMENTS 3 ARUBA TUNNELED INTERNET GATEWAY SOLUtiON 3 HOW thE TUNNELED INTERNET GATEWAY WORKS 3 APPENDIX 5 TOPOLOGY DIAGRAMS 8 ABOUT ARUBA NETWORKS, INC. 9 WHITE PAPER TUNNELED INTERNET GATEWAY THE CHALLENGE: WI-FI ACCESS FOR MOBILE HOW THE TUNNELED INTERNET GATEWAY WORKS DEVICES IN HIGH-SECURITY ENVIRONMENTS Summary Since the debut of the iPhone in 2007, the private sector The Tunneled Internet Gateway is enabled through software has seen a proliferation of personal mobile devices used in configuration to any new or existing controller-based Aruba the workplace. Government customers, while slower to WLAN. Mobile users connect their devices to the Internet adopt commercially available mobile devices in the gateway SSID, creating an encrypted session with an Aruba workplace, recognize the cost and productivity advantages Mobility Controller deployed in the restricted network. and are looking for ways to increase their usage and speed- up adoption. The controller maintains logical separation between Internet sessions and restricted sessions using a Common Criteria Many civilian and military organizations have already begun EAL4+ validated firewall, then routes Internet traffic through large-scale acquisitions of commercial off-the-shelf (COTS) an additional encrypted data tunnel to a router attached to a mobile devices for distribution to relevant personnel. The commercial Internet service provider. The result is a secure, February 2013 purchase by the U.S. Department of Defense simple and low-cost network overlay with strong separation of 630,000 Apple iOS-based mobile devices is just one between restricted and Internet data.
  • Anyconnect Captive Portal Detection and Remediation

    Anyconnect Captive Portal Detection and Remediation

    Contents Introduction Prerequisites Requirements Components Used Background Information Captive Portal Remediation Requirements Captive Portal Hotspot Detection Captive Portal Hotspot Remediation False Captive Portal Detection AnyConnect Behavior Captive Portal Incorrectly Detected with IKEV2 Workarounds Disable the Captive Portal Feature Introduction This document describes the Cisco AnyConnect Mobility Client captive portal detection feature and the requirements for it to function correctly. Many wireless hotspots at hotels, restaurants, airports, and other public places use captive portals in order to block user access to the Internet. They redirect HTTP requests to their own websites that require users to enter their credentials or acknowledge terms and conditions of the hotspot host. Prerequisites Requirements Cisco recommends that you have knowledge of the Cisco AnyConnect Secure Mobility Client. Components Used The information in this document is based on these software versions: ● AnyConnect Version 3.1.04072 ● Cisco Adaptive Security Appliance (ASA) Version 9.1.2 The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command. Background Information Many facilities that offer Wi-Fi and wired access, such as airports, coffee shops, and hotels, require users to pay before they obtain access, agree to abide by an acceptable
  • A Cybersecurity Terminarch: Use It Before We Lose It

    A Cybersecurity Terminarch: Use It Before We Lose It

    SYSTEMS ATTACKS AND DEFENSES Editors: Davide Balzarotti, [email protected] | William Enck, [email protected] | Samuel King, [email protected] | Angelos Stavrou, [email protected] A Cybersecurity Terminarch: Use It Before We Lose It Eric Osterweil | George Mason University term · in · arch e /’ t re m , närk/ noun an individual that is the last of its species or subspecies. Once the terminarch dies, the species becomes extinct. hy can’t we send encrypt- in the Internet have a long history W ed email (secure, private of failure. correspondence that even our mail To date, there has only been one providers can’t read)? Why do our success story, and, fortunately, it is health-care providers require us to still operating. Today, almost ev- use secure portals to correspond erything we do online begins with a with us instead of directly emailing query to a single-rooted hierarchical us? Why are messaging apps the global database, whose namespace only way to send encrypted messag- is collision-free, and which we have es directly to friends, and why can’t relied on for more than 30 years: we send private messages without the Domain Name System (DNS). user-facing) layer(s). This has left the agreeing to using a single platform Moreover, although the DNS pro- potential to extend DNSSEC’s verifi- (WhatsApp, Signal, and so on)? Our tocol did not initially have verifica- cation protections largely untapped. cybersecurity tools have not evolved tion protections, it does now: the Moreover, the model we are using to offer these services, but why? DNS Security Extensions (DNS- exposes systemic vulnerabilities.
  • Some Ethical Hacking Possibilities in Kali Linux Environment

    Some Ethical Hacking Possibilities in Kali Linux Environment

    Vol. 9, No. 4, 2019 pp. 129-149 http://doi.org/10.24368/jates.v9i4.139 21 129 Journal of Applied Technical and Educational Sciences jATES ISSN 2560-5429 http://jates.org Some ethical hacking possibilities in Kali Linux environment Petar Cisara, Robert Pinterb aUniversity of Criminal Investigation and Police Studies, Cara Dusana 196, 11080 Zemun, Serbia, [email protected] bSubotica Tech - College of Applied Sciences, Marka Oreskovica 16, 24000 Subotica, Serbia, [email protected] Abstract This paper deals with the problem of ethical hacking and security of computer systems. When we talk about security of an information system, we actually mean the primary three attributes of the system: confidentiality, integrity and availability. There are various approaches with aim to identify existing security weaknesses and security assessment. One of them is using Kali Linux operating system with its integrated effective tools specially adapted to the realization of various types of attacks. The paper gives a general overview of some Kali attacking possibilities on client and server side and highlights their specificities. The undoubted benefit of this operating system is a large collection of different hacking tools in one place which significantly facilitates vulnerability assessment and security testing. Keywords: Kali Linux; tools; attack; security; ethical hacking 1. Introduction In general, four main categories (or phases) of information security assessments can be identified (Hertzog, 2017): a vulnerability assessment, a compliance (audit) test, a traditional internal/external penetration test, and an application assessment. There are various methods with aim to identify existing security weaknesses and security assessment (Allen, 2014).